I just tried this, just like you described, on a site with a CDN setup and it worked. So, I think this might be limited to your site.
I think the DISCOURSE_ENABLE_CORS setting is the inverse of what you want. Adding domains to that setting will allow requests from those domains access to your Discourse domain, not the other way around.
What you want is to allow requests from your Discourse domain to get access to the file on your CDN. I think your CDN is blocking those requests. You can confirm that by running something like this in a terminal window, after you change the values of course.
curl -H "origin: YOUR_SITE_URL" -v "PATH_TO_THE_FONT_ON_YOUR_CDN"
If everything is setup correctly, you should see something like this in the response headers
Access-Control-Allow-Origin: *